Allow graceful handling of auth_tkt cookies outliving saml clients cache

If for some reason the session cookie outlives the saml clients cache,
for instance if the webservice is restarted there could be an
inconsistent state where the user is authenticated but saml attributes
are missing and saml logout requests will fail. By using only saml2sp
as authenticator plugin and repoze.who 2.0 this little check will work
around that and require a new login in this case
Added support for receiving SAMLRequests on the single_logout endpoint